EAP-SIM/AKA server: Allow pseudonym/fast reauth to be disabled

The new hostapd configuration option eap_sim_id can now be used to
disable use of pseudonym and/or fast reauthentication with EAP-SIM,
EAP-AKA, and EAP-AKA'.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 1f2c565832601b84f30aeed9741441d968511cf8..e09e6e141ba47a12e424be7ff18b0b3c2e143191 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -2629,6 +2629,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
                bss->eap_sim_db_timeout = atoi(pos);
        } else if (os_strcmp(buf, "eap_sim_aka_result_ind") == 0) {
                bss->eap_sim_aka_result_ind = atoi(pos);
+       } else if (os_strcmp(buf, "eap_sim_id") == 0) {
+               bss->eap_sim_id = atoi(pos);
 #endif /* EAP_SERVER_SIM */
 #ifdef EAP_SERVER_TNC
        } else if (os_strcmp(buf, "tnc") == 0) {

diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 5138aeebc4c586912d4be27d351cad86c77627e6..ce3ecdddf157007bb9d6e73fb6d31694e3886c4f 100644 (file)
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -1205,6 +1205,13 @@ eap_server=0
 # (default: 0 = disabled).
 #eap_sim_aka_result_ind=1
 
+# EAP-SIM and EAP-AKA identity options
+# 0 = do not use pseudonyms or fast reauthentication
+# 1 = use pseudonyms, but not fast reauthentication
+# 2 = do not use pseudonyms, but use fast reauthentication
+# 3 = use pseudonyms and use fast reauthentication (default)
+#eap_sim_id=3
+
 # Trusted Network Connect (TNC)
 # If enabled, TNC validation will be required before the peer is allowed to
 # connect. Note: This is only used with EAP-TTLS and EAP-FAST. If any other

diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 968eb65a622d170c903fc12a265f59424dbfedc4..90348e1ddb971f0c0af72bab2a0765e3cf08dbb4 100644 (file)
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -78,6 +78,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
 
        bss->radius_server_auth_port = 1812;
        bss->eap_sim_db_timeout = 1;
+       bss->eap_sim_id = 3;
        bss->ap_max_inactivity = AP_MAX_INACTIVITY;
        bss->eapol_version = EAPOL_VERSION;
 

diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 0a1d49b717157e5397ba72b510ebfb988f0094bb..ea581a8222778b86256e51ad58c4c33cd46b40d3 100644 (file)
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -430,6 +430,7 @@ struct hostapd_bss_config {
        int eap_teap_auth;
        int eap_teap_pac_no_inner;
        int eap_sim_aka_result_ind;
+       int eap_sim_id;
        int tnc;
        int fragment_size;
        u16 pwd_group;

diff --git a/src/ap/authsrv.c b/src/ap/authsrv.c
index b3d910742e50f5567fd28038df72f6dc70f7dd2b..4f5fe7db4482c0c67ded92d714f59612fd6cd877 100644 (file)
--- a/src/ap/authsrv.c
+++ b/src/ap/authsrv.c
@@ -123,6 +123,7 @@ static int hostapd_setup_radius_srv(struct hostapd_data *hapd)
        srv.eap_teap_auth = conf->eap_teap_auth;
        srv.eap_teap_pac_no_inner = conf->eap_teap_pac_no_inner;
        srv.eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
+       srv.eap_sim_id = conf->eap_sim_id;
        srv.tnc = conf->tnc;
        srv.wps = hapd->wps;
        srv.ipv6 = conf->radius_server_ipv6;

diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c
index ab6989b0dd0fbfcf225334272517ca7ef131b51b..e0614710f6c3ced62153aa455650c8294aff291b 100644 (file)
--- a/src/ap/ieee802_1x.c
+++ b/src/ap/ieee802_1x.c
@@ -2437,6 +2437,7 @@ int ieee802_1x_init(struct hostapd_data *hapd)
        conf.eap_teap_auth = hapd->conf->eap_teap_auth;
        conf.eap_teap_pac_no_inner = hapd->conf->eap_teap_pac_no_inner;
        conf.eap_sim_aka_result_ind = hapd->conf->eap_sim_aka_result_ind;
+       conf.eap_sim_id = hapd->conf->eap_sim_id;
        conf.tnc = hapd->conf->tnc;
        conf.wps = hapd->wps;
        conf.fragment_size = hapd->conf->fragment_size;

diff --git a/src/eap_server/eap.h b/src/eap_server/eap.h
index a32c8835cdc7fa5a24042ac9545fc1b257900330..a9cf5c97bee72d5279bf2ed28b3f0f13a9d5c0b4 100644 (file)
--- a/src/eap_server/eap.h
+++ b/src/eap_server/eap.h
@@ -124,6 +124,7 @@ struct eap_config {
        int eap_teap_auth;
        int eap_teap_pac_no_inner;
        int eap_sim_aka_result_ind;
+       int eap_sim_id;
        int tnc;
        struct wps_context *wps;
        const struct wpabuf *assoc_wps_ie;

diff --git a/src/eap_server/eap_i.h b/src/eap_server/eap_i.h
index 8e6ac46496831477403e59e362d2d7bd1f2c19f9..f9ab32d69d7527025bb56fa1efdb20a0ac9366bc 100644 (file)
--- a/src/eap_server/eap_i.h
+++ b/src/eap_server/eap_i.h
@@ -193,6 +193,7 @@ struct eap_sm {
        int eap_teap_auth;
        int eap_teap_pac_no_inner;
        int eap_sim_aka_result_ind;
+       int eap_sim_id;
        int tnc;
        u16 pwd_group;
        struct wps_context *wps;

diff --git a/src/eap_server/eap_server.c b/src/eap_server/eap_server.c
index 724ec154fdd80f6e416d97a6a9b522a72beaad23..568eebd7e77ed807c76aa1552a2280f9cd66b5a4 100644 (file)
--- a/src/eap_server/eap_server.c
+++ b/src/eap_server/eap_server.c
@@ -1872,6 +1872,7 @@ struct eap_sm * eap_server_sm_init(void *eapol_ctx,
        sm->eap_teap_auth = conf->eap_teap_auth;
        sm->eap_teap_pac_no_inner = conf->eap_teap_pac_no_inner;
        sm->eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
+       sm->eap_sim_id = conf->eap_sim_id;
        sm->tnc = conf->tnc;
        sm->wps = conf->wps;
        if (conf->assoc_wps_ie)

diff --git a/src/eap_server/eap_server_aka.c b/src/eap_server/eap_server_aka.c
index e145a12a5a2355d9350563a986ca9a17c30b0cc3..4dadfe197c6b81f8b61b3a3fe84c777459c6de4d 100644 (file)
--- a/src/eap_server/eap_server_aka.c
+++ b/src/eap_server/eap_server_aka.c
@@ -393,7 +393,10 @@ static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
                              const u8 *nonce_s)
 {
        os_free(data->next_pseudonym);
-       if (nonce_s == NULL) {
+       if (!(sm->eap_sim_id & 0x01)) {
+               /* Use of pseudonyms disabled in configuration */
+               data->next_pseudonym = NULL;
+       } else if (!nonce_s) {
                data->next_pseudonym =
                        eap_sim_db_get_next_pseudonym(
                                sm->eap_sim_db_priv,
@@ -404,7 +407,10 @@ static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
                data->next_pseudonym = NULL;
        }
        os_free(data->next_reauth_id);
-       if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
+       if (!(sm->eap_sim_id & 0x02)) {
+               /* Use of fast reauth disabled in configuration */
+               data->next_reauth_id = NULL;
+       } else if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
                data->next_reauth_id =
                        eap_sim_db_get_next_reauth_id(
                                sm->eap_sim_db_priv,

diff --git a/src/eap_server/eap_server_sim.c b/src/eap_server/eap_server_sim.c
index f8aa508ecd5fa073e351fe9e12c1c8c8df445bff..5243568e71d0399c79b2175fc014741662499a0a 100644 (file)
--- a/src/eap_server/eap_server_sim.c
+++ b/src/eap_server/eap_server_sim.c
@@ -150,7 +150,10 @@ static int eap_sim_build_encr(struct eap_sm *sm, struct eap_sim_data *data,
                              const u8 *nonce_s)
 {
        os_free(data->next_pseudonym);
-       if (nonce_s == NULL) {
+       if (!(sm->eap_sim_id & 0x01)) {
+               /* Use of pseudonyms disabled in configuration */
+               data->next_pseudonym = NULL;
+       } else if (!nonce_s) {
                data->next_pseudonym =
                        eap_sim_db_get_next_pseudonym(sm->eap_sim_db_priv,
                                                      EAP_SIM_DB_SIM);
@@ -159,7 +162,10 @@ static int eap_sim_build_encr(struct eap_sm *sm, struct eap_sim_data *data,
                data->next_pseudonym = NULL;
        }
        os_free(data->next_reauth_id);
-       if (data->counter <= EAP_SIM_MAX_FAST_REAUTHS) {
+       if (!(sm->eap_sim_id & 0x02)) {
+               /* Use of fast reauth disabled in configuration */
+               data->next_reauth_id = NULL;
+       } else if (data->counter <= EAP_SIM_MAX_FAST_REAUTHS) {
                data->next_reauth_id =
                        eap_sim_db_get_next_reauth_id(sm->eap_sim_db_priv,
                                                      EAP_SIM_DB_SIM);

diff --git a/src/eapol_auth/eapol_auth_sm.c b/src/eapol_auth/eapol_auth_sm.c
index b7423d135c0097910b250aa0144c693445c0dbf5..7206d32d7391cc8fb5cc81f0ea1afe36a1d5d357 100644 (file)
--- a/src/eapol_auth/eapol_auth_sm.c
+++ b/src/eapol_auth/eapol_auth_sm.c
@@ -838,6 +838,7 @@ eapol_auth_alloc(struct eapol_authenticator *eapol, const u8 *addr,
        eap_conf.eap_teap_auth = eapol->conf.eap_teap_auth;
        eap_conf.eap_teap_pac_no_inner = eapol->conf.eap_teap_pac_no_inner;
        eap_conf.eap_sim_aka_result_ind = eapol->conf.eap_sim_aka_result_ind;
+       eap_conf.eap_sim_id = eapol->conf.eap_sim_id;
        eap_conf.tnc = eapol->conf.tnc;
        eap_conf.wps = eapol->conf.wps;
        eap_conf.assoc_wps_ie = assoc_wps_ie;
@@ -1236,6 +1237,7 @@ static int eapol_auth_conf_clone(struct eapol_auth_config *dst,
        dst->eap_teap_auth = src->eap_teap_auth;
        dst->eap_teap_pac_no_inner = src->eap_teap_pac_no_inner;
        dst->eap_sim_aka_result_ind = src->eap_sim_aka_result_ind;
+       dst->eap_sim_id = src->eap_sim_id;
        dst->tnc = src->tnc;
        dst->wps = src->wps;
        dst->fragment_size = src->fragment_size;

diff --git a/src/eapol_auth/eapol_auth_sm.h b/src/eapol_auth/eapol_auth_sm.h
index 41b6b1b1a0ea32151ee5775872a648371efdd264..bcdd50971569170128f8fc81af3e292162ee1db7 100644 (file)
--- a/src/eapol_auth/eapol_auth_sm.h
+++ b/src/eapol_auth/eapol_auth_sm.h
@@ -39,6 +39,7 @@ struct eapol_auth_config {
        int eap_teap_auth;
        int eap_teap_pac_no_inner;
        int eap_sim_aka_result_ind;
+       int eap_sim_id;
        int tnc;
        struct wps_context *wps;
        int fragment_size;

diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c
index 1b605c7f085d47a1025720d497e3ff42382b440f..70efd11b49d96ccd15275b3198e54da301378138 100644 (file)
--- a/src/radius/radius_server.c
+++ b/src/radius/radius_server.c
@@ -249,6 +249,8 @@ struct radius_server_data {
         */
        int eap_sim_aka_result_ind;
 
+       int eap_sim_id;
+
        /**
         * tnc - Trusted Network Connect (TNC)
         *
@@ -798,6 +800,7 @@ radius_server_get_new_session(struct radius_server_data *data,
        eap_conf.eap_teap_auth = data->eap_teap_auth;
        eap_conf.eap_teap_pac_no_inner = data->eap_teap_pac_no_inner;
        eap_conf.eap_sim_aka_result_ind = data->eap_sim_aka_result_ind;
+       eap_conf.eap_sim_id = data->eap_sim_id;
        eap_conf.tnc = data->tnc;
        eap_conf.wps = data->wps;
        eap_conf.pwd_group = data->pwd_group;
@@ -2393,6 +2396,7 @@ radius_server_init(struct radius_server_conf *conf)
        data->eap_teap_pac_no_inner = conf->eap_teap_pac_no_inner;
        data->get_eap_user = conf->get_eap_user;
        data->eap_sim_aka_result_ind = conf->eap_sim_aka_result_ind;
+       data->eap_sim_id = conf->eap_sim_id;
        data->tnc = conf->tnc;
        data->wps = conf->wps;
        data->pwd_group = conf->pwd_group;

diff --git a/src/radius/radius_server.h b/src/radius/radius_server.h
index 88c22db86ce17905217774b63e746fb96447fe51..54896946eca96d5ea02d574d1a0bc65599b6ad72 100644 (file)
--- a/src/radius/radius_server.h
+++ b/src/radius/radius_server.h
@@ -139,6 +139,8 @@ struct radius_server_conf {
         */
        int eap_sim_aka_result_ind;
 
+       int eap_sim_id;
+
        /**
         * tnc - Trusted Network Connect (TNC)
         *